sock: reset sk_err for ICMP packets read from error queue (83a1a1a7) · Commits · 戴 / test

Only when ICMP packets are enqueued onto the error queue, sk_err is also set. Before (sock: do not set sk_err in sock_dequeue_err_skb), a subsequent error queue read would set sk_err to the next error on the queue, or 0 if empty. As no error types other than ICMP set this field, sk_err should not be modified upon dequeuing them. Only for ICMP errors, reset the (racy) sk_err. Some applications, like traceroute, rely on it and go into a futile busy POLLERR loop otherwise. In principle, sk_err has to be set while an ICMP error is queued. Testing is_icmp_err_skb(skb_next) approximates this without requiring a full queue walk. Applications that receive both ICMP and other errors cannot rely on this legacy behavior, as other errors do not set sk_err in the first place. Fixes: (sock: do not set sk_err in sock_dequeue_err_skb) Signed-off-by:

Soheil Hassas Yeganeh <soheil@google.com> Signed-off-by:

Willem de Bruijn <willemb@google.com> Acked-by:

Eric Dumazet <edumazet@google.com> Acked-by:

Maciej Żenczykowski <maze@google.com> Signed-off-by:

David S. Miller <davem@davemloft.net>

net/core/skbuff.c

+13 −4

Original line number	Original line	Diff line number	Diff line
	@@ -3714,20 +3714,29 @@ int sock_queue_err_skb(struct sock sk, struct sk_buff skb)
	}		}
	EXPORT_SYMBOL(sock_queue_err_skb);		EXPORT_SYMBOL(sock_queue_err_skb);

			static bool is_icmp_err_skb(const struct sk_buff *skb)
			{
			return skb && (SKB_EXT_ERR(skb)->ee.ee_origin == SO_EE_ORIGIN_ICMP \|\|
			SKB_EXT_ERR(skb)->ee.ee_origin == SO_EE_ORIGIN_ICMP6);
			}

	struct sk_buff sock_dequeue_err_skb(struct sock sk)		struct sk_buff sock_dequeue_err_skb(struct sock sk)
	{		{
	struct sk_buff_head *q = &sk->sk_error_queue;		struct sk_buff_head *q = &sk->sk_error_queue;
	struct sk_buff skb, skb_next;		struct sk_buff skb, skb_next = NULL;
			bool icmp_next = false;
	unsigned long flags;		unsigned long flags;
	int err = 0;

	spin_lock_irqsave(&q->lock, flags);		spin_lock_irqsave(&q->lock, flags);
	skb = __skb_dequeue(q);		skb = __skb_dequeue(q);
	if (skb && (skb_next = skb_peek(q)))		if (skb && (skb_next = skb_peek(q)))
	err = SKB_EXT_ERR(skb_next)->ee.ee_errno;		icmp_next = is_icmp_err_skb(skb_next);
	spin_unlock_irqrestore(&q->lock, flags);		spin_unlock_irqrestore(&q->lock, flags);

	if (err)		if (is_icmp_err_skb(skb) && !icmp_next)
			sk->sk_err = 0;

			if (skb_next)
	sk->sk_error_report(sk);		sk->sk_error_report(sk);

	return skb;		return skb;

Admin message